CVE-2026-8856: IBM HTTP Server is affected by multiple vulnerabilities
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.5.5.30Patch PH71265 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.5.29Patch PH71265 - Compensating control
For vulnerable IBM HTTP Server configurations where an attacker has write access to parts of the server configuration, restrict/limit write access to the affected server configuration locations to prevent an attacker from modifying configuration.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8856?
CVE-2026-8856 has a critical severity rating of 9.1.
What systems are affected by CVE-2026-8856?
CVE-2026-8856 affects IBM HTTP Server versions 8.5 and 9.0.
How can I fix CVE-2026-8856?
To fix CVE-2026-8856, apply a currently available interim fix or fix pack that includes the fix for APAR PH71265.
What is the risk associated with CVE-2026-8856?
CVE-2026-8856 carries a risk rating of 47, indicating significant potential impact.
Can CVE-2026-8856 lead to denial of service?
Yes, CVE-2026-8856 can lead to denial of service if an attacker has write access to parts of the server configuration.